6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1[.]exe

resource
6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1.exe
unpack001/$PLUGINSDIR/System.dll

6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1
MD5 d8e62254f40965d5b3098a09670bd335
SHA1 9b051c51c63b2d2bc1b5d41940cd8ed9b2a8e468
SHA512 7c7d02aaf03825b11b0ede959c5c20ab139c65de9a2433ae10af2ebbf43413c54cf1fccba90679225c3ecf1617ad25513a5fc6ba011db669aefbb7cee7f34c80
SSDEEP 12288:Xa/AcZ6qJ2s1+pBOiV0e/YoPLdDbst0WhcHCE34N2XdgjPEmADNA0EpphZNG2O:X4Z6SQB5VrwodDb/WhcHCtvjsmY0O
TLSH
T1BAE423A5F298C1B7E4668BF5D535C7F489BC9E60EA28C3031745BEAC3C761448E0A3D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13145

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Avowing/klasikkens.txt

SHA256 7aea294fbdc4cfa3972c4bf45a2c787f38174b5a0e8a3c2ab45acb0fc5b5d120
MD5 349c3014ad27290cecaf439303816708
SHA1 33c07d049a06eda444a3ab12e4e935d61618adc8
SHA512 801b190430e8fbed64d7ee2e1bcaa2a35651e5c261d79726e93668d7f13dea58d8ccd34edbca3fd4340b219ab1fa75cb2f58adae2ef79741c8886462a6a16fce
TLSH
T138F00E20EEA33ABBCD93122E9B212AD1D46D41208226BAB2C45FA2A7441C7C40C6CB24
MD5 SHA1 SHA512 TLSH

Avowing/opdateringssiderne.int

SHA256 d05e57bc53965ea455c243b24bd34a5549ed8f08698c834a411435f0eb9f893d
MD5 a751d549670670f890f5a08cc4f5a4d6
SHA1 c44d434264f7dae94c0d5a7fb58053d81b99391d
SHA512 03fdfe35fc7d8dd0bf02e7e78c7d69b989a6a495bd4ecbdd34c1012ae82b7abfdbe8fc30b82705bf54bdbd0f2493f7a04f78f9fa15809a8461ad556b8a584aa8
SSDEEP 1536:n9B+wZ0kdeJjeICC3gnX++yF9zMVwwC6mfPWc:n950dCqaXFyPzM1mfB
TLSH
T1EDB41318981D00A9F38D1E814A9F916EE2A918F44C6DD3741CF646E3B2BBCD3CFA91D4
MD5 SHA1 SHA512 SSDEEP TLSH

Avowing/pataca.rei

SHA256 33d5edae3829ef41e644cd76d9bc5f8386420513bd254ca7ab4a88c5c615810c
MD5 cce99d8b4c78640993aa75d7c428d061
SHA1 6c4f21368687d9a2c8423032bcc8e0ed3227da07
SHA512 47ed14565c2d4208f66a7ae070454243f26d06c72f784b9c8675ba172a0b94cf85868778e8de07f12abe6078a29d58a833fa269bfd82cd47a01e9e4601730836
SSDEEP 768:KtofaHIEDu5ffzIabBiHt/tAr4ajzjk8NG4GwGuV0VXHfR:1faDwfzIaAYDjk8gXfR
TLSH
T10044017D8FDAFF65AD0D17D195690B910800A88B31A7C61B9F6315AC07B105F78EA8FC
MD5 SHA1 SHA512 SSDEEP TLSH

Glimrer/Aphthartodocetic.ini

SHA256 e2c21afe2ccd6e3d219780f268500bb8337d8b891e8595ec7c49ac35baac2057
MD5 90ec9feaab66462033fbb70fb9a3ee4b
SHA1 7aef435efc9c6007010315d6a7278a04e5a52429
SHA512 2cf848417755b906827eb26e42f84b8a454ea409855f3705d74e66f0f4340b8019d914e6616d302a69363a5f834a6e1ccb9a1f2b7887fa5a42bd11cae317beb4
TLSH
T115E0F1F0AF544403AE9347131C101197053D9345E005241602E507C016E88A747FCC64
MD5 SHA1 SHA512 TLSH

Glimrer/Canaliculation.Erh

SHA256 e666b4245201318438b554f7ee18b6a24c1b6c3b59a61d22e445971d2d4c24e3
MD5 434d21557adc4baeab69a57e8d4898aa
SHA1 bfc29155b0e1d26d15e34044feda3e51c4dca2a4
SHA512 9f9d7fdff38a1fd627e9564e3fb002263cb08a1e481dc8d40001c8e99aa9e07170d942681537d5b6531f43c15f01b9a4940ad3fde47e3c57936dac1ea5224058
SSDEEP 1536:7oEBwkMa1QLURe18shk/fSwTZ859qEOIWp1X2Hs+vuyYuF4ZIY5LWXfdzPK91dZE:DBZiLvGu7JjPAeNlIKPDcdPW+8Tdpz
TLSH
T1B7943D5075CD8AE0F61A5984EA78FFB201733973AFCA1CD22324F5004ABE5553A8DA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Glimrer/Innovativeness151.jpg

SHA256 7b1f375157924d100b36c83547fd9a070c5c2f99aa2821af7372d73dd34a264b
MD5 c9abf950b5ea7c4e30dd9f58fc96e8d2
SHA1 783b728f9c93a86a9524af93f9df2ec851a38a69
SHA512 c40dafa22a0d2aeab1757d1ef4a4d47a5a3098552c98ab1ca36a4c8d4eb6526acd632737ace30c04dd56c37f967b2477991db1a461bac329a26b6a050ea6a7be
SSDEEP 768:JPcUFwwqj73AuqAnmlcjknNblmP1CvYUI3dtz1VSA:JPcUsjHqOwxDYiA
TLSH
T15BD2D05FA643C9A3E21A8BF97B343C74A69027AC2E72B5F825408FB71B101B85C50779
MD5 SHA1 SHA512 SSDEEP TLSH

Glimrer/desorienteres.txt

SHA256 79ab4370ca578d5fa793bfe1a3041d70b95855d3056594fa41edc00ecf416a20
MD5 663e26e192d34c89a21482f86a0cc079
SHA1 d50c89ddf76d97b7fff7afbb20fe698b820f35be
SHA512 b9a84b48f8a8f733f10a88f285169eca7416e6fe1a2b51b73a4a4228c7a8781292dcbde1ff748ecd1e7ff14b743f3e0bf455ee3c1bd0bf2454b0e33b39a30fa3
TLSH
T174F00E24CD0671A66B626342FCD05B9240BF8A154541E0F8B14C934F1A5C5BC5330268
MD5 SHA1 SHA512 TLSH

Glimrer/gennemskylnings.txt

SHA256 c49f3f671b7cbf550040ea2dc10d462a46d87c7d62ca0f85c6cdfe86a42cecd2
MD5 790ebf2ac0ca4adcdb58e45d0a450dbc
SHA1 d18f698c2aa650d78ad5167e3b2b9953f54d3f8a
SHA512 1f3d6ee159d0ee604d22a6565228f41c58fadcf141b8a69a277d70b8d74a3306205b3fc56c1f4d93873056bf29c68053305b55eea3b878a0c967739d224a445b
TLSH
T12EF02D90DCE968E8A45BA1E6FF09452E6AB6C013C0A82921B092038CB09087CC3F4DA7
MD5 SHA1 SHA512 TLSH

Glimrer/gerry.pad

SHA256 7ba4160056fb1b321e5859a9aa1f9c277b9c798b968c34e735f5222710e7ed09
MD5 766d9ef7530d23758f482b0ab2b54788
SHA1 c430e21b1463eceb32d05c6f0909d9821c27a3e7
SHA512 5bc154b564af204c25d2e7651e3c4c9f9263c3e6a88f149ddbe9892baf0b26079e171aebac4dd334ee8192ec4f2c5d510536a2287ad1eea5bd357aaafabad68f
SSDEEP 192:vp3MOAy7WiXB2O1NUcFWb38pStMMI81jeUWBmSF//LzzIxj13gjwKWuQ6SSph7NC:x3vArO7WwNM/JUZe3gjw36z7A
TLSH
T1ABD2AFC151B075DB212D2F2E59946B53E5CE6A9AC3C007DEA1990ED3DEEF52F1D31880
MD5 SHA1 SHA512 SSDEEP TLSH

Glimrer/inkassogebyrers.txt

SHA256 7a0296f17e8bded15e306321af16a537dfe424ea806bda138402c11453c27e1d
MD5 ac5918c28b077c9134d607dd4da5c7d8
SHA1 0b6e4cd64998d4a6bdcbd6698f1388bb0b4f204d
SHA512 0b83b999a6ee4fd22604df2ed2610403abeaa24aa0926db61c91f63b9477a0aa63da1ac8b6c2de348f523e7ed4c414cd28a30b75e8b6faded2c2431d5f6a6f5e
TLSH
T1C7F0ACE4ED440AA3021F6FBF79B920528138AB4B43235572A4888319A2A90985B7DA32
MD5 SHA1 SHA512 TLSH

Scoptophobia.Puy

SHA256 74bb62269418d44ccb15690ddae7483e589cae1189c9c24b10112ff38ad460e5
MD5 f649fb081bee2b924dbb7f42b3e25a24
SHA1 d5c7796461c0715bf7feddab3669f8bf77b277ff
SHA512 adf487f10447f1aec11e7c8ce81ffecf208570c303e830f6014b96b319479ce524a0d79ef93a17ac04155b9a7139961ea8dbafc5320d4df710fb2af2f1f19ec8
SSDEEP 3072:MTU3UvDV9izxmCDVgzlKSXIQURj6jqg3tU1Wze1uVdWt9lvulsCWtPh8PNmf8wOE:nMy9N2AklKjiPze1uVsZ2lsCWj8PSOE
TLSH
T19D24F163E7A4C961C83AE83DDC2526DC291B2C004D9B57D36969312942BFF74ED92EC3
MD5 SHA1 SHA512 SSDEEP TLSH

6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Avowing/klasikkens.txt

Avowing/opdateringssiderne.int

Avowing/pataca.rei

Glimrer/Aphthartodocetic.ini

Glimrer/Canaliculation.Erh

Glimrer/Innovativeness151.jpg

Glimrer/desorienteres.txt

Glimrer/gennemskylnings.txt

Glimrer/gerry.pad

Glimrer/inkassogebyrers.txt

Scoptophobia.Puy

Sharing

General

Malware Config

Signatures

File Explorer

6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Avowing/klasikkens.txt

Avowing/opdateringssiderne.int

Avowing/pataca.rei

Glimrer/Aphthartodocetic.ini

Glimrer/Canaliculation.Erh

Glimrer/Innovativeness151.jpg

Glimrer/desorienteres.txt

Glimrer/gennemskylnings.txt

Glimrer/gerry.pad

Glimrer/inkassogebyrers.txt

Scoptophobia.Puy